| Título | Codeastro Internet Banking System 1 Open redirection |
|---|
| Descripción | Vulnerability Report
Project Name: Internet Banking System in PHP
Vendor: codeastro.com
Project Link: [Internet Banking System]( https://codeastro.com/internet-banking-system-in-php-with-source-code/)
Vulnerability Type: Open Redirection
Affected Parameter: http://localhost/InternetBanking-PHP/client/pages_dashboard.php
Severity: Low
Description:
The Internet Banking System is vulnerable to an open redirection attack in pages_dashboard.php when an attacker enters a redirection payload in the “Client Full Name” field at pages_client_signup.php page. When the user tries to login he will be redirected to another website by the attacker.
Exploited Parameter:
- Client Full Name Field at pages_client_signup.php
Payloads Used:
<meta http-equiv="refresh" content="0; url=https://www.facebook.com/login/" />
Recommendations:
1. *Input Validation:* Implement strict input validation to prevent XSS injection.
2. *Update System:* Keep the Real Estate Management System, PHP, and server components up-to-date with the latest security patches.
3. *Security Audits:* Regularly audit system security and consider professional assessments to identify and fix vulnerabilities.
4. *Education:* Train developers on secure coding practices, emphasizing input validation and secure database handling.
Timeline:
- Discovery Date: [22/01/2024] |
|---|
| Fuente | ⚠️ https://drive.google.com/drive/folders/1f61RXqelSDY0T92aLjmb8BhgAHt_eeUS |
|---|
| Usuario | Mohammed Aashique (UID 62025) |
|---|
| Sumisión | 2024-01-22 05:12 (hace 3 años) |
|---|
| Moderación | 2024-01-22 12:05 (7 hours later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 251697 [CodeAstro Internet Banking System 1.0 pages_client_signup.php Client Full Name Redirect] |
|---|
| Puntos | 20 |
|---|